Winpcap分析 -- NPF_CreateDevice

NPF_CreateDevice：这个函数主要是创建设备，并为设备创建符号链接，这其中涉及到的标准API请参考wdk文档

• 首先会对传递进来的设备名字做合法性判断：()

  if (RtlCompareMemory(amacNameP->Buffer, devicePrefix.Buffer,
      devicePrefix.Length) < devicePrefix.Length)
  {
      return FALSE;
  }

  NDIS_STRING devicePrefix = NDIS_STRING_CONST(//Device// )

• 然后会对设备名字和符号链接名字做一系列的初始化，如分配空间，组合字符串等

  deviceName.Length = 0;
  deviceName.MaximumLength = (USHORT)(amacNameP->Length + g_NPF_Prefix.Length + sizeof(UNICODE_NULL));
  deviceName.Buffer = ExAllocatePoolWithTag(PagedPool, deviceName.MaximumLength, '3PWA');

  if (deviceName.Buffer == NULL)
      return FALSE;

  deviceSymLink.Length = 0;
  deviceSymLink.MaximumLength =(USHORT)(amacNameP->Length-devicePrefix.Length
      + symbolicLinkPrefix.Length
      + g_NPF_Prefix.Length
      + sizeof(UNICODE_NULL));

  deviceSymLink.Buffer = ExAllocatePoolWithTag(NonPagedPool, deviceSymLink.MaximumLength, '3PWA');

  if (deviceSymLink.Buffer  == NULL)
  {
      ExFreePool(deviceName.Buffer);
      return FALSE;
  }

  RtlAppendUnicodeStringToString(&deviceName, &devicePrefix);
  RtlAppendUnicodeStringToString(&deviceName, &g_NPF_Prefix);
  RtlAppendUnicodeToString(&deviceName, amacNameP->Buffer +
      devicePrefix.Length / sizeof(WCHAR));

  RtlAppendUnicodeStringToString(&deviceSymLink, &symbolicLinkPrefix);
  RtlAppendUnicodeStringToString(&deviceSymLink, &g_NPF_Prefix);
  RtlAppendUnicodeToString(&deviceSymLink, amacNameP->Buffer +
      devicePrefix.Length / sizeof(WCHAR));

• 最后就是创建设备和符号链接

  status = IoCreateDevice(adriverObjectP,
          sizeof(DEVICE_EXTENSION),
          &deviceName,
          FILE_DEVICE_TRANSPORT,
  #ifdef __NPF_NT4__
          0,
  #else //__NPF_NT4__
          FILE_DEVICE_SECURE_OPEN,   
  #endif //__NPF_NT4__
          FALSE,
          &devObjP);

  IoCreateSymbolicLink(&deviceSymLink,&deviceName)